Transcript Computer Security: Principles and Practice, 1/e

COMPUTER SECURITY: PRINCIPLES
AND PRACTICE
Chapter 5 – Database Security
First Edition
by William Stallings and Lawrie Brown
Lecture slides by Lawrie Brown
DATABASE SECURITY
RELATIONAL DATABASES

constructed from tables of data
 each
column holds a particular type of data
 each row contains a specific value these
 ideally has one column where all values are unique,
forming an identifier/key for that row
have multiple tables linked by identifiers
 use a query language to access data items
meeting specified criteria

RELATIONAL DATABASE EXAMPLE
RELATIONAL DATABASE ELEMENTS
relation / table / file
 tuple / row / record
 attribute / column / field
 primary key

 uniquely

foreign key
 links

identifies a row
one table to attributes in another
view / virtual table
RELATIONAL DATABASE ELEMENTS
STRUCTURED QUERY LANGUAGE

Structure Query Language (SQL)
 originally
developed by IBM in the mid-1970s
 standardized language to define, manipulate,
and query data in a relational database
 several similar versions of ANSI/ISO standard
CREATE TABLE department (
Did INTEGER PRIMARY KEY,
Dname CHAR (30),
Dacctno CHAR (6) )
CREATE VIEW newtable (Dname, Ename, Eid, Ephone)
AS SELECT D.Dname E.Ename, E.Eid, E.Ephone
FROM Department D Employee E
WHERE E.Did = D.Did
CREATE TABLE employee (
Ename CHAR (30),
Did INTEGER,
SalaryCode INTEGER,
Eid INTEGER PRIMARY KEY,
Ephone CHAR (10),
FOREIGN KEY (Did) REFERENCES department (Did) )
DATABASE ACCESS CONTROL

Three Keywords:




DBMS provide access control for database
assume have authenticated user
DBMS provides specific access rights to portions of the
database




MAC, DAC, RBAC
e.g. create, insert, delete, update, read, write
to entire database, tables, selected rows or columns
possibly dependent on contents of a table entry
can support a range of policies:



centralized administration
ownership-based administration
decentralized administration
SQL ACCESS CONTROLS

two commands:

GRANT { privileges | role } [ON table] TO
{ user | role | PUBLIC } [IDENTIFIED BY
password] [WITH GRANT OPTION]


REVOKE { privileges | role } [ON table]
FROM { user | role | PUBLIC }


e.g. GRANT SELECT ON ANY TABLE TO ricflair
e.g. REVOKE SELECT ON ANY TABLE FROM ricflair
typical access rights are:

SELECT, INSERT, UPDATE, DELETE, REFERENCES
CASCADING AUTHORIZATIONS
ROLE-BASED ACCESS CONTROL

role-based access control work well for DBMS
 eases

admin burden, improves security
categories of database users:
 application
owner
 end
user
 administrator

DB RBAC must manage roles and their users
 cf.
RBAC on Microsoft’s SQL Server
INFERENCE
INFERENCE EXAMPLE
INFERENCE COUNTERMEASURES

inference detection at database design
 alter

inference detection at query time
 by

database structure or access controls
monitoring and altering or rejecting queries
need some inference detection algorithm
a
difficult problem
 cf. employee-salary example
STATISTICAL DATABASES

provides data of a statistical nature
 e.g.

counts, averages
two types:
 pure
statistical database
 ordinary database with statistical access
 some
users have normal access, others statistical
access control objective to allow statistical
use without revealing individual entries
 security problem is one of inference

STATISTICAL DATABASE SECURITY

use a characteristic formula C
a

logical formula over the values of attributes
e.g. (Sex=Male) AND ((Major=CS) OR (Major=EE))
query set X(C) of characteristic formula C, is the
set of records matching C
 a statistical query is a query that produces a
value calculated over a query set

STATISTICAL DATABASE EXAMPLE
PROTECTING
AGAINST
INFERENCE
TRACKER ATTACKS

divide queries into parts
C
= C1.C2
 count(C.D) = count(C1) - count (C1. ~C2)
combination is called a tracker
 each part acceptable query size
 overlap is desired result

OTHER QUERY RESTRICTIONS

query set overlap control
 limit
overlap between new & previous queries
 has problems and overheads

partitioning
 cluster
records into exclusive groups
 only allow queries on entire groups

query denial and information leakage
 denials
can leak information
 to counter must track queries from user
PERTURBATION

add noise to statistics generated from data


data perturbation techniques



data swapping
generate statistics from probability distribution
output perturbation techniques



will result in differences in statistics
random-sample query
statistic adjustment
must minimize loss of accuracy in results
DATABASE ENCRYPTION

databases typical a valuable info resource


protected by multiple layers of security: firewalls,
authentication, O/S access control systems, DB access
control systems, and database encryption
can encrypt



entire database - very inflexible and inefficient
individual fields - simple but inflexible
records (rows) or columns (attributes) - best


also need attribute indexes to help data retrieval
varying trade-offs
DATABASE ENCRYPTION
SUMMARY
introduced databases and DBMS
 relational databases
 database access control issues

 SQL,
role-based
inference
 statistical database security issues
 database encryption
